CVE-2026-105272: Medium severity GROWI GROWI vulnerability
GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and comments of pages without the required read permission.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have low-level privileges. Exploitation does not require user interaction, but the attack complexity is rated high.
What information could be exposed or changed?
A successful attacker may obtain page contents and comments for pages they do not have permission to read. The provided severity vector also indicates low confidentiality and integrity impact, with no availability impact.
Which GROWI versions are affected or fixed?
The provided information identifies GROWI as the affected product but does not specify affected or fixed versions.